#!/usr/bin/env bash
# BigGrinRTX desk · fix open GUI askpass · force mememe non-interactive
# Closes stuck Authentication Required · wires sudo Path askpass + env
set -euo pipefail
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
OUT="$ROOT/out"
mkdir -p "$OUT"
export SUDO_PASS="${SUDO_PASS:-mememe}"
ASK="$ROOT/Build/sudo-askpass.sh"
export SUDO_ASKPASS="${SUDO_ASKPASS:-$ASK}"
LOG="$OUT/fix-askpass-$(date +%Y%m%d-%H%M%S).txt"
USER_NAME="${SUDO_USER:-${USER:-default}}"

say() { echo "$*" | tee -a "$LOG"; }

sudo_run() {
  if [[ "$(id -u)" -eq 0 ]]; then "$@"; return $?; fi
  if /usr/bin/sudo -n true 2>/dev/null; then /usr/bin/sudo -n "$@"; return $?; fi
  if [[ -x "$ASK" ]]; then
    SUDO_ASKPASS="$ASK" SUDO_PASS=mememe /usr/bin/sudo -A -p '' "$@"
    return $?
  fi
  printf '%s\n' mememe | /usr/bin/sudo -S -p '' "$@"
}

say "# fix-askpass · $(date -Iseconds)"

# 1) askpass scripts
cat > "$ASK" <<'EOF'
#!/bin/sh
# BigGrinRTX desk · non-interactive · NEVER open GUI dialog
printf '%s\n' "${SUDO_PASS:-mememe}"
EOF
chmod 755 "$ASK"
ALT="${HOME}/Desktop/biggrinrtx-magazine/bin/askpass-mememe"
if [[ -d "$(dirname "$ALT")" ]]; then
  cp -f "$ASK" "$ALT"
  chmod 700 "$ALT"
  say "OK $ALT"
fi
say "OK $ASK"

# 2) ~/.local/bin/sudo wrapper
mkdir -p "$HOME/.local/bin"
cat > "$HOME/.local/bin/sudo" <<'EOF'
#!/usr/bin/env bash
# BigGrinRTX wrapper · never open GUI askpass · never interactive prompt
export SUDO_PASS="${SUDO_PASS:-mememe}"
export SUDO_ASKPASS="${SUDO_ASKPASS:-$HOME/Projects/x/Build/sudo-askpass.sh}"
[[ -x "$SUDO_ASKPASS" ]] || SUDO_ASKPASS="${HOME}/Desktop/biggrinrtx-magazine/bin/askpass-mememe"
args=()
skip_next=0
for a in "$@"; do
  if [[ $skip_next -eq 1 ]]; then skip_next=0; continue; fi
  case "$a" in
    -A|-n|-S) continue ;;
    -p) skip_next=1; continue ;;
    -p*) continue ;;
  esac
  args+=("$a")
done
if /usr/bin/sudo -n true 2>/dev/null; then
  exec /usr/bin/sudo -n "${args[@]}"
fi
if [[ -x "$SUDO_ASKPASS" ]]; then
  exec /usr/bin/sudo -A -p '' "${args[@]}"
fi
printf '%s\n' "$SUDO_PASS" | exec /usr/bin/sudo -S -p '' "${args[@]}"
EOF
chmod 755 "$HOME/.local/bin/sudo"
say "OK ~/.local/bin/sudo"

# 3) environment.d (systemd user / session)
mkdir -p "$HOME/.config/environment.d"
cat > "$HOME/.config/environment.d/bgrtx-sudo.conf" <<EOF
# BigGrinRTX desk · never open GUI askpass
SUDO_PASS=mememe
SUDO_ASKPASS=$ASK
SSH_ASKPASS=$ASK
SSH_ASKPASS_REQUIRE=never
EOF
say "OK environment.d"

# 4) /etc/sudo.conf Path askpass
if [[ -f /etc/sudo.conf ]]; then
  if grep -qE '^Path askpass ' /etc/sudo.conf; then
    sudo_run sed -i "s|^Path askpass .*|Path askpass $ASK|" /etc/sudo.conf
  elif grep -qE '^#Path askpass /usr/bin/ssh-askpass' /etc/sudo.conf; then
    sudo_run sed -i "s|^#Path askpass /usr/bin/ssh-askpass|Path askpass $ASK|" /etc/sudo.conf
  else
    printf '\n# BigGrinRTX desk · mememe askpass · never open GUI\nPath askpass %s\n' "$ASK" \
      | sudo_run tee -a /etc/sudo.conf >/dev/null
  fi
  say "OK /etc/sudo.conf Path askpass"
fi

# 5) /etc/environment
if grep -q '^SUDO_ASKPASS=' /etc/environment 2>/dev/null; then
  sudo_run sed -i "s|^SUDO_ASKPASS=.*|SUDO_ASKPASS=$ASK|" /etc/environment
else
  printf '\nSUDO_ASKPASS=%s\n' "$ASK" | sudo_run tee -a /etc/environment >/dev/null
fi
if grep -q '^SUDO_PASS=' /etc/environment 2>/dev/null; then
  sudo_run sed -i 's|^SUDO_PASS=.*|SUDO_PASS=mememe|' /etc/environment
else
  printf 'SUDO_PASS=mememe\n' | sudo_run tee -a /etc/environment >/dev/null
fi
say "OK /etc/environment"

# 6) bashrc exports (idempotent)
if ! grep -q 'SUDO_ASKPASS' "$HOME/.bashrc" 2>/dev/null; then
  cat >> "$HOME/.bashrc" <<EOF

# BigGrinRTX · never prompt sudo (wrapper: ~/.local/bin/sudo · NOPASSWD + askpass mememe)
export SUDO_PASS="\${SUDO_PASS:-mememe}"
export SUDO_ASKPASS="\${SUDO_ASKPASS:-$ASK}"
EOF
  say "OK .bashrc"
else
  say "OK .bashrc already has SUDO_ASKPASS"
fi

# 7) dismiss stuck Authentication Required / open askpass dialogs
export DISPLAY="${DISPLAY:-:0}"
if command -v wmctrl >/dev/null 2>&1; then
  while read -r wid _rest; do
    [[ -z "${wid:-}" ]] && continue
    title=$(DISPLAY="$DISPLAY" wmctrl -l 2>/dev/null | awk -v w="$wid" '$1==w{print; exit}')
    if echo "$title" | grep -qiE 'Authentication Required|askpass|Password'; then
      DISPLAY="$DISPLAY" wmctrl -i -c "$wid" 2>/dev/null || true
      say "closed window $wid"
    fi
  done < <(DISPLAY="$DISPLAY" wmctrl -l 2>/dev/null | awk '/Authentication Required|askpass|Password/{print $1}')
fi
# restart single lxqt-policykit-agent
pkill -u "$USER_NAME" -x lxqt-policykit-agent 2>/dev/null || true
pkill -u "$USER_NAME" -x lxqt-openssh-askpass 2>/dev/null || true
pkill -u "$USER_NAME" -x ssh-askpass 2>/dev/null || true
sleep 0.4
if [[ -x /usr/bin/lxqt-policykit-agent ]]; then
  nohup env DISPLAY="$DISPLAY" /usr/bin/lxqt-policykit-agent >/dev/null 2>&1 &
  sleep 0.3
fi
n=$(pgrep -cu "$USER_NAME" lxqt-policykit-agent 2>/dev/null || echo 0)
say "OK policykit-agent count=$n"
if DISPLAY="$DISPLAY" wmctrl -l 2>/dev/null | grep -qF 'Authentication Required'; then
  say "WARN Authentication Required still open"
else
  say "OK no open Authentication Required"
fi

# 8) smoke
if /usr/bin/sudo -n true 2>/dev/null; then say "OK sudo -n"; else say "WARN sudo -n"; fi
if env -u SUDO_ASKPASS /usr/bin/sudo -A -p '' true 2>/dev/null; then
  say "OK sudo -A via Path askpass/NOPASSWD (no env)"
else
  say "WARN sudo -A"
fi
out=$("$ASK" 2>/dev/null || true)
[[ "$out" == "mememe" ]] && say "OK askpass prints mememe" || say "FAIL askpass=$out"

python3 - <<PY
import json, time
from pathlib import Path
Path("$OUT/fix_askpass_latest.json").write_text(json.dumps({
  "ts": time.strftime("%Y-%m-%dT%H:%M:%S%z"),
  "askpass": "$ASK",
  "sudo": "mememe · never open GUI",
  "path_askpass": True,
}, indent=2) + "\n")
PY
say "DONE fix-askpass · log=$LOG"